@blamejs/pki 0.9.8 → 0.9.9

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.9.9 — 2026-10-27
+
+Refuse an IPv4 address spelled as a host name wherever a certificate identity is matched, whatever the Node version.
+
+### Changed
+
+- A reference identity such as `999.999.999.999`, which is neither an address nor a domain name, is refused with `identity/bad-reference` instead of being compared against dNSName entries.
+
+### Security
+
+- `pki.identity.match` refuses a reference identity whose last label is a number, or `0x` followed by hex digits, with `identity/bad-reference`, as a string and as the value of a `dns`, `srv` or `uri` record. Before, `0127.0.0.1`, `0177.0.0.1` and `0x7f.0.0.1` were matched by the dNSName `*.0.0.1`, `127.0.0.1.` by `127.0.0.1`, and `127.1` by `*.1`, and a `dns` record carrying the canonical `127.0.0.1` was matched by the dNSName `127.0.0.1`. An address is passed as the canonical dotted quad or as octets, which is compared only against `iPAddress` entries. A domain reference must also be made of letters, digits, hyphens, dots and underscores, so `127.0.0.%31` (which WHATWG URL decodes to 127.0.0.1), `::1` and `[::1]` are refused rather than compared against dNSName entries.
+- `pki.path.validate` refuses such an `opts.identity` with `path/bad-input`. Before, a leaf whose only subject alternative name was the dNSName `*.0.0.1` validated for identity `0x7f.0.0.1` under an excluded `iPAddress` subtree of 127.0.0.0/8, because the subtree applies only to `iPAddress` entries.
+- `pki.transport.https` and `pki.transport.peerChain`, and every client built on them, refuse a `tls.servername` that is such a value with `transport/bad-input`, and a `proxy.tls.servername` with `transport/bad-proxy`. A servername holding any character other than a letter, digit, hyphen, dot or underscore, including a fullwidth digit, a NUL, a percent escape or a bracketed IPv6 address, is refused the same way; a canonical address literal is still accepted. Node below 24.22.1 matched `0x7f.0.0.1` or `127` written in fullwidth digits against the dNSName `127.0.0.1`.
+- The ACME verbs refuse such a value as a `dns` identifier with `acme/bad-identifier`, in an authorization, an order, the subject `commonName` of a finalize CSR and `pki.acme.verifyTlsAlpn01`, so a finalize CSR naming one in a dNSName matches no order identifier. An address takes the `ip` identifier type (RFC 8738 sec. 3); as a `dns` identifier, a validation certificate's dNSName would prove it.
+- A URI name constraint, and the presented host of a uniformResourceIdentifier name, no longer read a host such as `0x7f.0.0.1` as a domain name. A constraint base of that form is refused as an address.
+
 ## v0.9.8 — 2026-10-27
 
 Require Node 24.22.1, which fixes the Brotli decoder memory corruption in CVE-2026-111497.

package/lib/acme.js

@@ -456,6 +456,13 @@ function _assertDnsName(name) {
     if (!_isLdhLabel(l)) throw E("acme/bad-identifier", "a dns label must be lowercase LDH ASCII (A-label): " + JSON.stringify(l));
     if (l.indexOf("xn--") === 0 && !_isXnLabel(l)) throw E("acme/bad-identifier", "a malformed xn-- A-label: " + JSON.stringify(l));
   }
+  /** @internal A resolver and WHATWG URL read a name whose last label is a number as IPv4, so
+   *  `127.0.0.1`, `0x7f.0.0.1` and `127.1` are addresses rather than domain names. An address takes the
+   *  `ip` identifier type (RFC 8738 sec. 3); as a `dns` identifier, a dNSName SAN would prove it. */
+  if (ipUtils.endsInANumber(name)) {
+    throw E("acme/bad-identifier", "a dns identifier value is read as an IPv4 address by a resolver and by WHATWG URL; " +
+      "an address uses the ip identifier type (RFC 8738 sec. 3): " + _stringify(name));
+  }
 }
 
 function _assertIpAddress(value) {

package/lib/guard-name.js

@@ -446,12 +446,6 @@ function _charTable(chars) {
   for (var i = 0; i < chars.length; i++) t[_charCodeAt(chars, i)] = true;
   return t;
 }
-var _DIGDOT_TABLE = _charTable("0123456789.");
-function _allCharsIn(s, table) {
-  if (s.length === 0) return false;
-  for (var i = 0; i < s.length; i++) if (!table[_charCodeAt(s, i)]) return false;
-  return true;
-}
 
 /** @internal The one trailing dot a host name may be written with, removed before it is compared.
  *
@@ -485,7 +479,7 @@ function isFqdnHost(host) {
   if (typeof host !== "string") return false;
   var h = stripTrailingDot(host);
   if (!_isHostName(h)) return false;
-  if (_allCharsIn(h, _DIGDOT_TABLE)) return false;
+  if (_ipUtils.endsInANumber(h)) return false;
   return true;
 }
 
@@ -527,6 +521,13 @@ function _isHostName(s) {
 // @enforced-by behavioral -- an LDH label walk has no rename-proof shape that separates it from any other per-character scan; the vectors refusing an empty label, a hyphen at a label edge and a name past 253 octets are the guard
 function isHostName(s) { return typeof s === "string" && _isHostName(s); }
 
+/** @internal Whether a character code can appear in a host name a caller hands the toolkit: a letter,
+ * a digit, a hyphen, a dot or an underscore. A percent escape is decoded by WHATWG URL, so
+ * `127.0.0.%31` reaches 127.0.0.1, and a colon or a bracket spells an IPv6 address; neither is a
+ * host name. */
+// @enforced-by behavioral -- a character-class test has no rename-proof shape; the vectors refusing a percent escape, a colon and a bracket in a reference identity and in a TLS servername are the guard
+function isHostNameChar(c) { return _LDH_ALNUM[c] === true || c === 0x2d || c === 0x2e || c === 0x5f; }
+
 /** @internal The labels of `s`, in order, with no trailing-dot handling of its own: the caller
  * normalizes the dot through `stripTrailingDot` so both sides of a comparison are normalized by
  * one symbol. A name carrying an empty label yields an empty string at that position, which a
@@ -1019,7 +1020,7 @@ function constraintBaseRefusal(tag, base) {
     var uriBody = _toLowerCase(base);
     if (_charAt(uriBody, 0) === ".") uriBody = _strSlice(uriBody, 1);
     if (isFqdnHost(uriBody)) return null;
-    return _allCharsIn(stripTrailingDot(uriBody), _DIGDOT_TABLE)
+    return _ipUtils.endsInANumber(uriBody)
       ? "must be a domain name rather than an address, RFC 5280 sec. 4.2.1.10 naming an address in a URI's authority as what a URI constraint cannot be compared against"
       : "must be a domain name, which RFC 5280 sec. 4.2.1.10 requires of a URI constraint, optionally written as a subtree with a leading dot";
   }
@@ -1148,7 +1149,7 @@ module.exports = intrinsic.freeze({
   isAttributeDescriptor: isAttributeDescriptor,
   lowerAscii: lowerAscii, uriSchemeIs: uriSchemeIs,
   stripTrailingDot: stripTrailingDot, isFqdnHost: isFqdnHost, splitMailbox: splitMailbox,
-  isHostName: isHostName, hostLabels: hostLabels, isXnLabel: isXnLabel, uriParts: uriParts,
+  isHostName: isHostName, isHostNameChar: isHostNameChar, hostLabels: hostLabels, isXnLabel: isXnLabel, uriParts: uriParts,
   uriEqual: uriEqual, dnsNameEqual: dnsNameEqual, generalNameEqual: generalNameEqual,
   constraintBaseRefusal: constraintBaseRefusal,
   constraintBaseUnreadable: constraintBaseUnreadable,

package/lib/http-transport.js

@@ -88,6 +88,7 @@ var nodeUtil = require("node:util");
 var constants = require("./constants");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+var ipUtils = require("./ip-utils");
 /** @internal The certificate reader, and the two operations the distrust walk proves a link with,
  *  taken at load. A replaced `verify` would answer whether each link of a server chain is signed by
  *  the certificate above it. */
@@ -697,6 +698,25 @@ var PROXY_KEYS = _keySet(["url", "auth", "tls"]);
 var PROXY_AUTH_KEYS = _keySet(["scheme", "username", "password", "allowMD5", "allowLegacyQop"]);
 var PROXY_DIGEST_KNOBS = ["allowMD5", "allowLegacyQop"];
 var PROXY_TLS_KEYS = _keySet(["anchors", "useSystemStore", "servername", "minVersion", "distrustedKeys"]);
+/** @internal A servername is a DNS name (RFC 6066 sec. 3) of letters, digits, hyphens, dots and
+ *  underscores, or a canonical address literal. A percent escape or a bracketed IPv6 address is
+ *  neither. A value whose last label is a number but which is not a canonical address (`0x7f.0.0.1`,
+ *  `0177.0.0.1`, `127.1`, `127.0.0.1.`, or `127.0.0.1` in fullwidth digits) is an address in another
+ *  spelling. Node below 24.22.1 matched such a name against the certificate's dNSName entries
+ *  (CVE-2026-106072, CVE-2026-105483), so `DNS:127.0.0.1` authenticated it. It is refused here
+ *  whatever the runtime does. */
+function _assertServername(s, E, code, what) {
+  if (_isIP(s)) return;
+  for (var i = 0; i < s.length; i++) {
+    if (!guard.name.isHostNameChar(_charCodeAt(s, i))) {
+      throw E(code, what + " carries a character at offset " + i + " that no host name holds; a servername is a DNS " +
+        "name of letters, digits, hyphens, dots and underscores (RFC 6066 sec. 3) or a canonical address literal");
+    }
+  }
+  if (ipUtils.endsInANumber(s)) {
+    throw E(code, what + " " + guard.text.showValue(s) + " is an IPv4 address in a non-canonical spelling; pass the canonical dotted quad or a DNS name");
+  }
+}
 /** @internal The names a `tls` policy bag may carry. A name outside them is refused rather than
  *  ignored: a misspelled `distrustedKeys` or `anchors` would otherwise leave the connection under a
  *  policy the caller did not state. */
@@ -820,6 +840,7 @@ function _validateProxy(request, defaults, E, C, originHost, originStatedPort, o
       if (!_copyableRecord(ptls)) throw E(C("bad-proxy"), "opts.proxy.tls must be a plain object with only own enumerable data properties");
       guard.identifier.assertKnownKeys(ptls, PROXY_TLS_KEYS, E, C("bad-proxy"), "opts.proxy.tls has an unknown option ");
       if (ptls.servername !== undefined && ptls.servername !== null && typeof ptls.servername !== "string") throw E(C("bad-proxy"), "opts.proxy.tls.servername must be a string");
+      if (typeof ptls.servername === "string") _assertServername(ptls.servername, E, C("bad-proxy"), "opts.proxy.tls.servername");
     }
     /** @internal Taken here, so the value the tunnel is opened under is the one typed above rather
      * than a later read of the caller's record. The door refuses an accessor and refuses a Proxy, so
@@ -1107,6 +1128,7 @@ function httpsTransport(defaults) {
      * as `idHost` for the name the server certificate is matched against. A value answering a
      * different string per read sends one name and verifies another. */
     if (typeof sni !== "string") throw E(C("bad-input"), "tls.servername must be a string, got " + guard.text.showValue(sni));
+    _assertServername(sni, E, C("bad-input"), "tls.servername");
     if (sni && !_isIP(sni)) options.servername = sni;
     var caList = [];
     if (hasAnchors) {

package/lib/identity-match.js

@@ -89,6 +89,27 @@ function _assertNoWildcard(s, what) {
   }
 }
 
+/** @internal A domain is a host name and never an address. Its characters are letters, digits,
+ * hyphens, dots and underscores, so a percent escape (`127.0.0.%31`, which WHATWG URL decodes to
+ * 127.0.0.1) and an IPv6 spelling (`::1`, `[::1]`) are refused. RFC 9525 sec. 3 classifies an IP
+ * address as an IP-ID and sec. 6.4 never compares one as a DNS-ID. A resolver and WHATWG URL read any host whose last label
+ * is a number as IPv4 (`0x7f.0.0.1`, `0177.0.0.1`, `127.1`, `2130706433`, `127.0.0.1.`), and
+ * `0127.0.0.1` reaches 87.0.0.1 under URL but 127.0.0.1 under some resolvers. Compared as a domain,
+ * such a value was authenticated by a dNSName like `127.0.0.1` or `*.0.0.1`. */
+function _assertNotAnAddress(v, what) {
+  for (var i = 0; i < v.length; i++) {
+    if (!guard.name.isHostNameChar(_charCodeAt(v, i))) {
+      throw E("identity/bad-reference", what + " carries " + guard.text.showValue(v[i]) + " at offset " + i +
+        ", which no host name holds. A host name is letters, digits, hyphens, dots and underscores; a percent " +
+        "escape is decoded by WHATWG URL and a colon or bracket spells an IPv6 address");
+    }
+  }
+  if (ip.endsInANumber(v)) {
+    throw E("identity/bad-reference", what + " is read as an IPv4 address by a resolver and by WHATWG URL, so it is " +
+      "not a domain name. Pass an address as the canonical dotted quad or as octets (RFC 9525 sec. 3)");
+  }
+}
+
 /** @internal The domain of a reference identity, normalized the way both sides are normalized: one
  * trailing dot stripped, then held to the label rules so an empty label or a label past 63
  * characters is a caller mistake, not a name that can never match. */
@@ -96,6 +117,7 @@ function _referenceDomain(v, what) {
   if (typeof v !== "string" || v === "") throw E("identity/bad-reference", what + " must be a non-empty string");
   _assertAsciiReference(v, what);
   _assertNoWildcard(v, what);
+  _assertNotAnAddress(v, what);
   var d = _stripTrailingDot(v);
   if (d === "" || d.length > MAX_HOST) {
     throw E("identity/bad-reference", what + " must be a domain name of 1 to " + MAX_HOST + " characters");
@@ -487,6 +509,11 @@ function _search(refs, entries, wildcardsAllowed) {
  * its service type and its domain together, so no comparison can pair the service of one
  * reference with the domain of another (sec. 6.5).
  *
+ * A domain whose last label is a number, such as `0x7f.0.0.1`, `0177.0.0.1`, `127.1`,
+ * `2130706433` or `127.0.0.1.`, is an IPv4 address to a resolver and to WHATWG URL, so it is
+ * refused with `identity/bad-reference` in every form rather than compared against dNSName
+ * entries. An address is passed as the canonical dotted quad or as octets.
+ *
  * The subject distinguished name is never a source of identity. The `commonName` is not read
  * under any option or fallback, including when the certificate carries no subjectAltName at
  * all, and neither is any other RDN (sec. 2, RFC 9110 sec. 4.3.4). A certificate presenting

package/lib/ip-utils.js

@@ -42,6 +42,29 @@ function isIPv4(s) {
   return true;
 }
 
+/** @internal Whether a host is one WHATWG URL parses as IPv4: the "ends in a number" check of the
+ *  URL Standard's host parser. With one trailing dot dropped, the last label is all ASCII digits, or
+ *  `0x` / `0X` followed by hex digits or nothing. A resolver (inet_aton) reads the same strings as
+ *  an address, so `0x7f.0.0.1`, `0177.0.0.1`, `127.1`, `2130706433` and `127.0.0.1.` all name
+ *  127.0.0.1. A host this answers true for and `isIPv4` answers false for is an address in a
+ *  non-canonical spelling, never a domain name. */
+function endsInANumber(s) {
+  if (typeof s !== "string") return false;
+  var parts = _splitOn(s, ".");
+  if (parts[parts.length - 1] === "") {
+    if (parts.length === 1) return false;
+    parts.length -= 1;
+  }
+  var last = parts[parts.length - 1], n = last.length, i;
+  if (n === 0) return false;
+  var digits = true;
+  for (i = 0; i < n; i += 1) { if (!_isDigitCode(_charCodeAt(last, i))) { digits = false; break; } }
+  if (digits) return true;
+  if (n < 2 || _charCodeAt(last, 0) !== 48 || (_charCodeAt(last, 1) | 0x20) !== 0x78) return false;
+  for (i = 2; i < n; i += 1) { if (!_isHexCode(_charCodeAt(last, i))) return false; }
+  return true;
+}
+
 function _isHexGroup(g) {
   var n = g.length, i;
   if (n < 1 || n > 4) return false;
@@ -151,6 +174,6 @@ function canonicalizeIpv6(value) {
 }
 
 module.exports = {
-  isIPv4: isIPv4, expandIpv6Hex: expandIpv6Hex, isIpLiteral: isIpLiteral, packIpLiteral: packIpLiteral,
+  isIPv4: isIPv4, endsInANumber: endsInANumber, expandIpv6Hex: expandIpv6Hex, isIpLiteral: isIpLiteral, packIpLiteral: packIpLiteral,
   textFromOctets: textFromOctets, canonicalizeIpv6: canonicalizeIpv6,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.9.8",
+  "version": "0.9.9",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:28a2dc7f-a34d-48fb-911a-b3c269f6e1bc",
+  "serialNumber": "urn:uuid:8b9305d6-9fdd-4cc8-9197-8b59f0469f8f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-27T17:35:33.081Z",
+    "timestamp": "2026-10-27T18:43:36.397Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.9.8",
+      "bom-ref": "@blamejs/pki@0.9.9",
       "type": "application",
       "name": "pki",
-      "version": "0.9.8",
+      "version": "0.9.9",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.9.8",
+      "purl": "pkg:npm/%40blamejs/pki@0.9.9",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.9.8",
+      "ref": "@blamejs/pki@0.9.9",
       "dependsOn": []
     }
   ]